locked up (mostly) everything from outside users;

for new things, edit the controller and write load_and_authorize_resource into it, to lock it down

yeah.